wp-config.php holds WordPress's core configuration. If we set your site up, some of these will already be in place.
What is in there
- Database details – name, user and password. Anyone with this file can read your whole site's data, which is why it should be 600 or 644 and never world-writable.
- Security keys and salts – a block of long random strings used to sign cookies. Changing them logs everybody out immediately, which is a useful thing to do after a compromise.
- Table prefix – usually wp_ but sometimes changed.
Settings we commonly add
define( 'DISABLE_WP_CRON', true );
Turns off WordPress's visitor-driven scheduler because we run a real scheduled task instead – see Why WP-Cron is disabled on our servers.
define( 'WP_POST_REVISIONS', 5 );
Caps revisions so the database does not grow without limit.
define( 'DISALLOW_FILE_EDIT', true );
Stops PHP files being edited through the admin, so a stolen login cannot immediately install a backdoor.
Editing it safely
Take a copy first. A single typo here takes the entire site down, because nothing loads without it. Add your own lines above the comment that says to stop editing, never below it. And never leave a blank line or a space after the closing PHP tag – that alone can produce a "headers already sent" error.
